Dependency manifest uses unpinned versions
Liquity V1 + V2 (LUSD / BOLD)'s assessment for RD-F-133 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
v2 (liquity/bold) uses git submodules for all dependencies: Solady @ commit 362b2efd, openzeppelin-contracts @ commit bd325d56 (= OZ v4.9.5), V2-gov @ commit b880481d, forge-std @ commit 726a6ee5. Git submodule pinning records exact commit SHAs in the superproject's tree — equivalent to exact version pinning, not semver ranges. No unpinned semver dependencies detected.
Sources #
- GitHubLiquity bold repository tree with submodule SHAsliquity/bold lib/ directory: 4 submodules at exact commit SHAsretrieved 2026-05-16
Methodology #
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).
See the full factor methodology and distribution across all protocols →